Caporal.js
Caporal.js copied to clipboard
Lodash security vulnerabilites in < 4.17.21
Caporal 2.0.2 relies on lodash version 4.17.15 explicitly, which has known critical security vulnerabilities
https://github.com/lodash/lodash/issues/5083
Reliance on lodash < 4.17.21 precludes us from using Caporal for the time being due to the security hole
Seems like the lodash version has been upgraded to 4.17.21.https://github.com/mattallty/Caporal.js/blob/2c11c11d5ee69bb69251b536e8b860a39e06dbd6/package.json#L126 Just need to release a new version of Caporal.
CC: @mattallty
I also have thtis issue ( https://github.com/mattallty/Caporal.js/issues/239 ) Dependabot sends a notification "We found potential security vulnerabilities in your dependencies."
Fixed